Rule Nature¶

Every rule category on the Rule System tab answers both how its rules detect and why the category exists at all. This tab is the second half: for each category, where the idea came from and what a finding means once you have one. The two pages are paired by subject, not by mechanism: a category's system page owns the mechanics and per-rule definitions, and its Nature page owns the provenance and interpretation.

The Rule Series page reads the other axis, by mechanism (R, H, C, and the rest). Series cross-cut subjects: a temporal finding can come from an H heuristic or a T history read, and an integrity finding is an integrity finding whichever series produced it.

Two more labels are easy to mistake for a third subject axis. The evidence layer (L1-L8) groups findings by the kind of evidence and is derived from the series with a small override table; it is a report view, not an independent taxonomy, and the numbers are not stages. The evidence tier (A-D) describes how a signal is sourced for scoring. The Rule labels explained puts all of them side by side.

Each page below opens with the rule IDs in its subject, so the series mix in a category is visible without leaving the page.

Categories¶

• Fetch and Execution; the classic fetch-then-run shape, the security core
• Obfuscation; making the recipe unreadable, so the reviewer cannot read it
• Deception and Anti-Analysis; tricks aimed at the reviewer, not the compiler
• Install and Persistence; arranging to run again after the build
• Staging and Reconnaissance; reading the target before acting
• Integrity and Verification; defeating the checksum promise
• Naming and Dependencies; name-clones and transitive trust
• Maintainer and Metadata; the account and recipe signals around the code
• Temporal Context; timing as evidence
• Composition; chains that are only dangerous together
• Count-Based; thresholds over matched evidence
• Corpus Behavioral; deviation from what the ecosystem normally does
• Crossfire; a package attacking its own build environment
• Sabotage; tampering with the code that gets built
• Unverifiable; claims TrustSight cannot check
• Meta and Confluence; the run's own health, and agreement across families
• Entropy; randomness as a build-output signal
• Correlation; the immune-import model of campaigns (the G-series)
• Artifact; what actually lands in the package
• Indicators; concrete observables from signed data
• Upstream Manifests; declared source against what upstream published
• Upstream Release Integrity; a declared upstream's build automation and unauditable source transports

See also¶

• Rule System tab; the catalog and mechanics
• Rule Series (mechanism); the mechanism axis
• Rule labels explained; series, subject, layer and tier side by side
• Assurance Layers; how the categories combine into a verdict